[Snort-users] Multiple threshold.conf

waldo kitty wkitty42 at ...14940...
Wed Jun 12 23:59:42 EDT 2013

On 6/12/2013 21:48, Steven McLaughlin wrote:
> Hi List,
> I have multiple sensors running one a box and I want to be able to tune globally
> or on a per sensor basis. This being the case, can I include two threshold files
> in the snort.conf like so:
> include threshold.conf               # For global threshold (loaded for all
> instances)
> include threshold_eth0.conf       # Per interface threshold

i would think so, yes... they are nothing more than include files with a 
specific syntax... their name doesn't even have to be threshold.conf IIANM...

NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.

More information about the Snort-users mailing list